Phonet: allocate and copy for pipe TX without sock lock

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 12 insertions, 17 deletions

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index cbaa1d67d77b..bdc17bdad366 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -843,7 +843,7 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
                         struct msghdr *msg, size_t len)
 {
         struct pep_sock *pn = pep_sk(sk);
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         long timeo;
         int flags = msg->msg_flags;
         int err, done;
@@ -851,6 +851,16 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (msg->msg_flags & MSG_OOB || !(msg->msg_flags & MSG_EOR))
                 return -EOPNOTSUPP;
 
+        skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
+                                        flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return -ENOBUFS;
+
+        skb_reserve(skb, MAX_PHONET_HEADER + 3);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+        if (err < 0)
+                goto outfree;
+
         lock_sock(sk);
         timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
         if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) {
@@ -894,28 +904,13 @@ disabled:
                         goto disabled;
         }
 
-        if (!skb) {
-                skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
-                                                flags & MSG_DONTWAIT, &err);
-                if (skb == NULL)
-                        goto out;
-                skb_reserve(skb, MAX_PHONET_HEADER + 3);
-
-                if (sk->sk_state != TCP_ESTABLISHED ||
-                    !atomic_read(&pn->tx_credits))
-                        goto disabled; /* sock_alloc_send_skb might sleep */
-        }
-
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
-        if (err < 0)
-                goto out;
-
         err = pipe_skb_send(sk, skb);
         if (err >= 0)
                 err = len; /* success! */
         skb = NULL;
 out:
         release_sock(sk);
+outfree:
         kfree_skb(skb);
         return err;
 }